Re: [PATCH 1/1] audit: log binding and unbinding to netlink multicast
On Mon, Oct 16, 2017 at 7:04 PM, Richard Guy Briggs <rgb(a)redhat.com> wrote:
To use the AUDIT_TASK record idea, a local audit context would need
to
be created and used for the AUDIT_CONFIG_CHANGE and AUDIT_TASK records
only.
For the record, the more I think about the AUDIT_TASK record idea, the
more I'm souring on the idea. Someday when we get around to an
attribute based format something like this will be handy (I'm thinking
we will want higher granularity when it comes to records), but right
now it doesn't seem very attractive to me.
--
paul moore
www.paul-moore.com